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davistl@sec.gov 

ROBERT L. TASHJIAN (Cal. Bar No. 191007) 
tashj ianr@sec. gov 

MATTHEW G. MEYERHOFER (Cal. Bar No. 268559) 
meyerhoferm@sec. gov 

Attorneys for Plaintiff 

SECURITIES AND EXCHANGE COMMISSION 
44 Montgomery Street, Suite 2800 
San Francisco, CA 94104 
(415) 705-2500 


UNITED STATES DISTRICT COURT 
NORTHERN DISTRICT OF CALIFORNIA 


SECURITIES AND EXCHANGE COMMISSION, 


Case No. 


Plaintiff, 


vs. 


COMPLAINT 


FACEBOOK, INC. 

Defendant. 


Plaintiff Securities and Exchange Commission (the “Commission”) alleges: 

SUMMARY OF THE ACTION 

1. For more than two years, Facebook made misleading statements in its required 
public filings about the misuse of its users’ data. From 2016 until mid-March 2018, Facebook 
presented the risk of misuse of its users’ data as merely hypothetical. In fact, Facebook had 
already become aware by December 2015 that a researcher had improperly sold information 
related to tens of millions of Facebook users to data analytics firm Cambridge Analytica. 

2. Since its initial public offering in 2012, Facebook has warned investors that one 
of the material risks to its business was the fact that independent developers who create 

applications for its platform might misuse personal data obtained from Facebook users. 
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3. In June 2014, an academic researcher and Cambridge Analytica entered into an 
agreement, through affiliated companies, whereby Cambridge Analytica would pay for the 
researcher to collect data on Facebook users. At Cambridge Analytical expense, the researcher 
developed a personality survey that obtained data from U.S. Facebook users, including their 
names, birthdates, gender, location, and their affinities, or “page likes.” From the summer of 
2014 through the spring of 2015, the researcher transferred data relating to approximately 

30 million Facebook users in the United States to Cambridge Analytica. 

4. Facebook learned about the collaboration between the researcher and Cambridge 
Analytica when it investigated a report published in the British press in December 2015. Within 
days of the press report, both the researcher and Cambridge Analytica privately confirmed to 
Facebook that the researcher had transferred personality profiles based on Facebook user data to 
Cambridge Analytica. Facebook detennined that the transfer violated its policy that prohibits 
developers, like the researcher, from selling or transferring its users’ data, and told the researcher 
and Cambridge Analytica to delete the data. 

5. In June 2016, the researcher told Facebook that, in addition to transferring 
Cambridge Analytica personality profiles for approximately 30 million of its users, he had also, 
for those same users, sold Cambridge a substantial quantity of the underlying Facebook data 
from which he had derived those profiles. 

6. In its quarterly and annual reports filed between January 28, 2016 and March 16, 
2018 (the “relevant period”), Facebook did not disclose that a researcher had, in violation of the 
company’s policies, transferred data relating to approximately 30 million Facebook users to 
Cambridge Analytica. Instead, Facebook misleadingly presented the potential for misuse of user 
data as merely a hypothetical investment risk. Moreover, when asked by reporters in 2017 about 
its investigation into the Cambridge Analytica matter, Facebook falsely claimed the company 
found no evidence of wrongdoing, thereby reinforcing the misleading statements in its periodic 
filings. 
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7. Facebook did not disclose that a researcher had improperly transferred data for 
millions of Facebook users to Cambridge Analytica until March 16, 2018, when the company— 
for the first time—publicly acknowledged on its website that it had learned of the violation of its 
policy in 2015. The price of Facebook shares declined substantially following the company’s 
disclosure. 

8. Based on the foregoing conduct, and the conduct described below, Facebook 
violated Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 (“Securities Act”) and 
Section 13(a) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rules 12b-20, 13a- 
1, 13a-13, and 13a-15(a) thereunder. 

JURISDICTION AND VENUE 

9. The Commission brings this action pursuant to Sections 20(b), 20(d), and 22(a) 
of the Securities Act [15 U.S.C. §§ 77t(b), 77t(d), and 77v(a)] and Sections 21(d), 21(e), and 27 
of the Exchange Act [15 U.S.C. §§ 78u(d), 78u(e), and 78aa]. 

10. This Court has jurisdiction over this action pursuant to Sections 20(b), 20(d)(1) 
and 22(a) of the Securities Act [15 U.S.C. §§ 77t(b), 77t(d)(l), and 77v(a)] and Sections 21(d), 
21(e) and 27 of the Exchange Act [15 U.S.C. §§ 78u(d), 78u(e) and 78aa]. 

11. Defendant, directly or indirectly, made use of the means and instrumentalities of 
interstate commerce or of the mails in connection with the acts, transactions, practices, and 
courses of business alleged in this complaint. 

12. Venue is proper in this District pursuant to Section 22(a) of the Securities Act 
[15 U.S.C. § 77v(a)] and Section 27(a) of the Exchange Act [15 U.S.C. § 78aa(a)]. Acts, 
transactions, practices, and courses of business that fonn the basis for the violations alleged in 
this complaint occurred in this District. Facebook employees who participated in the events 
alleged in this complaint worked in the company’s headquarters, which is located in Menlo Park, 
California. In addition, the relevant offers and sales of Facebook securities took place in this 
District. 
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13. Under Rule 3-2(d) of the Civil Local Rules, this civil action should be assigned to 
the San Francisco Division because a substantial part of the events or omissions which give rise 
to the claims alleged herein occurred in San Mateo County. 

DEFENDANT 

14. Facebook, Inc., a Delaware corporation based in Menlo Park, California, is an 
Internet platform that allows its users to share photos and other digital content with their 
“friends” on-line. Since its initial public offering in 2012, Facebook’s Class A common stock has 
been registered under Section 12(b) of the Exchange Act and trades on the Nasdaq Global Select 
Market. 

RELEVANT ENTITY 

15. Cambridge Analytica (“Cambridge”) was a data analytics and advertising firm 
affiliated with an entity in the United Kingdom known as the SCL Group. The firm and its 
affiliated entities filed for bankruptcy protection in the United States and the United Kingdom in 
2018. These organizations are collectively referred to as “Cambridge.” 

FACTUAL ALLEGATIONS 
Overview of Facebook’s Business 

16. Facebook derives substantially all of its revenue from advertising aimed at its 
users. More than 2.3 billion people used the company’s Facebook service on a monthly basis in 
the first quarter of 2019, and more than 2.7 billion people regularly used its broader family of 
services, which include Facebook, Instagram, and other services. The company generated more 
than $55.8 billion in revenue in its 2018 fiscal year and had a market capitalization of more than 
$500 billion as of March 31, 2019. 

17. Since it filed for its initial public offering in 2012, Facebook has acknowledged in 
its periodic filings with the Commission that the size of its user base and level of its user 
engagement are critical to its financial success. Facebook has recognized that its users’ 
willingness to engage with its services depends in part on users believing they have control over 
the way their data is shared. The “Risk Factor” disclosures in Facebook’s periodic filings warned 
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investors that concerns relating to data privacy and sharing could result in Facebook failing to 
retain or add users or in users decreasing their level of engagement, which could significantly 
harm its business, revenue, and financial results. 

18. One of the ways Facebook engages users is to allow unaffiliated software 
developers to create applications (or “apps”) that can access information that users share on 
Facebook. Facebook originally permitted developers to gather information from many app users’ 
friends in addition to the app user. Facebook deactivated this pennission in April 2014 but 
developers of existing apps were allowed to continue to collect data relating to an app user’s 
friends until April 2015. 

19. Developers who create Facebook apps must consent to Facebook’s “Platfonn 
Policy,” a set of rules governing what developers are allowed to do with the apps they create and 
the data that they gather. Since at least 2012, the Platfonn Policy has prohibited developers from 
selling user data or transfening user data to anyone who intends to profit from the data. The 
Platform Policy is maintained and updated by Facebook’s policy group, which works with others 
in the company to establish rules that govern, among other things, user privacy. Facebook also 
established a “Developer Operations” group within the company to prevent and address 
violations of the Platfonn Policy. 

The Sale of Facebook Data to Cambridge Analytica 

20. In November 2013, an academic researcher in the United Kingdom created a 
Facebook app in connection with his studies. In doing so, he agreed to abide by Facebook’s 
Platfonn Policy. Initially, the researcher used the app only for his own research. 

21. In January 2014, Cambridge approached the researcher about a possible business 
relationship. Cambridge was exploring a new model of election campaigning by targeting 
advertising based on voters’ personalities, and both Cambridge and the researcher were familiar 
with an academic study that conelated an individual’s personality with Facebook “l ik es.” 

22. Pursuant to a June 2014 agreement between Cambridge and the researcher, the 
researcher would collect data from the users of his Facebook app and their friends, use that 
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information to create personality “scores” for both app users and their friends, and then match 
these personality scores to individuals in Cambridge’s U.S. voter database. Cambridge would 
provide the researcher with funding to help recruit users to download and use the researcher’s 
app. 

23. The researcher configured his app to deliver a standard academic personality 
survey to app users. In addition to the survey results, the app obtained the name, birthdate, 
gender, location, and Facebook page likes both for the app users and the app users’ friends. 1 

24. In the summer and early fall of 2014, a business entity created and controlled by 
the researcher retained a surveying firm to recruit and pay approximately 270,000 Facebook 
users to download the researcher’s app and take the personality survey. This enabled the 
researcher to collect Facebook user data from both the 270,000 app users and many app users’ 
friends, which collectively amounted to tens of millions of Facebook users. From the survey 
responses, the researcher created personality scores for all 270,000 app users. Then, by analyzing 
the correlations between survey responses and page likes, the researcher derived “predicted” 
personality scores for the survey-takers’ tens of millions of friends. The researcher matched the 
personality scores against Cambridge’s database of American voters in 11 states, and transferred 
this matched data back to Cambridge, in violation of the Platfonn Policy. Cambridge used the 
scores to target advertisements in connection with its political consultancy services. Cambridge 
paid the researcher’s business entity for the costs associated with the work done by the surveying 
firm. 

25. In January 2015, the researcher and Cambridge signed a follow-on agreement. 
Pursuant to the agreement, Cambridge paid the researcher’s business entity £200,000 GBP, and 
the researcher, in violation of the Platform Policy, gave Cambridge the previously-collected 


1 On Facebook, “pages” are profiles that businesses or other organizations create in order to 
have a presence on Facebook. Organizations use Facebook pages to share information about 
products, services, and events. Individuals register their affinity to a particular organization by 
“liking” the organization’s Facebook page. “Page likes,” accordingly, represent a set of 
affinities connecting particular individuals to particular organizations. 
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names, birthdays, gender, location, personality scores, and an agreed-upon number of page likes 
for approximately 30 million Facebook users in all 50 states. By the end of May 2015, the 
researcher had transferred this information to Cambridge. 

26. The researcher also entered into a separate agreement with another entity, 
“Company A.” Pursuant to that agreement, the researcher provided Facebook demographic data 
and all page likes relating to approximately 30 million U.S. Facebook users to Company A in the 
fall of 2014. 

Facebook’s Investigation into Cambridge Analytical Use of Facebook Data 

27. On December 11, 2015, the British newspaper The Guardian published an article 
about the researcher and Cambridge reporting that the researcher had obtained Facebook data 
from tens of millions of Facebook users and used this data to create personality profiles for 
Cambridge’s use in American elections. 

28. The newspaper contacted Facebook before publishing its report and shared the 
allegations they intended to publish. Facebook provided the following quote attributable to a 
company spokesperson: “We are carefully investigating this situation. To be clear, misleading 
people or misusing their in formation is a direct violation of our policies and we will take swift 
action against companies that do, including banning those companies from Facebook and 
requiring them to destroy all improperly collected data.” The Guardian included the company’s 
statement in the article published on December 11, 2015. 

29. The day the Guardian article was published, a Facebook employee with 
responsibility for interpreting and administering the company’s Platfonn Policy contacted both 
the researcher and Cambridge. Within days, both the researcher and Cambridge confirmed to 
Facebook that the researcher had used a Facebook app to collect user data and then used that data 
to create personality scores, which were then transferred to Cambridge. 

30. The Facebook employee concluded that the researcher’s transfer of personality 
scores derived from Facebook user data to Cambridge violated the company’s Platform Policy. 
This conclusion was shared with others in Facebook’s communications, legal, operations, policy, 
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privacy, and research groups. The employee told the researcher and Cambridge to delete the 
personality scores and told the researcher to delete all of the Facebook data that his app had 
collected, and Cambridge subsequently told Facebook that it had deleted the data received from 
the researcher. 

31. Six months later, in June 2016, Facebook and the researcher signed a settlement 
agreement. In a certification attached to that agreement, the researcher reported—contrary to his 
and Cambridge’s representations in December 2015—that, in addition to the personality scores, 
he had also transferred actual U.S. Facebook user data, including names, birthdays, location, and 
certain page likes, to Cambridge. He also represented that he deleted all the Facebook data his 
app had collected. 

32. Almost a year later, in April 2017, Cambridge provided Facebook with a similar 
certification reporting that Cambridge had received from the researcher underlying raw 
Facebook user data in addition to the personality scores, as well as that it had deleted that data. 

33. All told, more than 30 Facebook employees in different corporate groups 
including senior managers in Facebook’s communications, legal, operations, policy, and privacy 
groups, learned that the researcher had transferred information to Cambridge in violation of 
Facebook’s Platform Policy. However, as discussed more fully below, Facebook had no specific 
policies or procedures in place to assess or analyze this information for the purposes of making 
accurate disclosures in Facebook’s periodic filings. 

Red Flags Raised About Cambridge Analytical Other Potential Misuse of User Data 

34. At the time of the December 2015 Guardian article, Facebook was already 
familiar with Cambridge and had suspicions that Cambridge had misused user data. In 
September 2015, employees in Facebook’s political advertising group requested an investigation 
into possible “scraping”—the automated and unauthorized aggregation of Facebook user data— 
by Cambridge. After the Guardian article was published in December 2015, these employees 
reiterated their concern about scraping. The political advertising employees recognized 
Cambridge as a well-known firm within the political advertising space and a client of Facebook’s 
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advertising business, and had described it as a “sketchy (to say the least) data modeling company 
that has penetrated our market deeply.” 

35. Throughout 2016, red flags were raised to Facebook suggesting that Cambridge 
was potentially misusing Facebook user data. Following the Guardian article, several Facebook 
employees became aware of media reports on Cambridge’s use of personality profiles to target 
advertising in the summer and fall of 2016. Facebook lawyers and employees in the company’s 
political advertising group saw and discussed an October 27, 2016, article in The Washington 
Post reporting that Cambridge combined psychological tests with “likes” on “social-media sites.” 
Employees responsible for coordinating Facebook’s response to the Guardian article also 
circulated a link to a video of a marketing presentation by Cambridge’s chief executive officer 
about the firm’s ability to target voters based on personality. As an additional indication to 
Facebook that Cambridge might have been misusing Facebook user data, some employees on 
Facebook’s political advertising team knew from August 2016 through November 2016 that 
Cambridge named Facebook and Instagram advertising audiences by personality trait for certain 
clients that included advocacy groups, a commercial enterprise, and a political action committee. 

36. Despite Facebook’s suspicions about Cambridge and the red flags raised after the 
Guardian article, Facebook did not consider how this in formation should have in formed the risk 
disclosures in its periodic filings about the possible misuse of user data. 

Facebook’s Misleading Public Filings 

37. Since the time of its initial public offering in 2012, Facebook has warned 
investors about the potential for misuse of its users’ data by developers and the possible 
consequent financial effect on the company’s business. For example, in the Risk Factor 
disclosures in its Fonn 10-Q filed on October 30, 2014, Facebook cautioned that “Improper 
access to or disclosure of user information, or violation of our terms of service or policies, could 
harm our reputation and adversely affect our business.” In the same Form 10-Q, the company 
advised that if developers “fail to comply with our terms and policies . . . our users’ data may be 
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improperly accessed or disclosed.” This, the company acknowledged, “could have a material and 
adverse effect on our business, reputation, or financial results.” 

38. Facebook modified this language beginning in January 2015 and continued to 
warn investors about the possibility that third parties might improperly access or misuse its users’ 
data. For example, in its Form 10-K filed on January 28, 2016, only weeks after it had confirmed 
that the researcher had improperly transferred personality scores derived from Facebook user 
data to Cambridge in violation of its Platform Policy, Facebook cautioned that “Any failure to 
prevent or mitigate security breaches and improper access to or disclosure of our data or user 
data could result in the loss or misuse of such data, which could harm our business and 
reputation and diminish our competitive position.” The company further asserted that if 
“developers fail to adopt or adhere to adequate data security practices . . . our data or our users’ 
data may be improperly accessed, used, or disclosed.” 2 

39. During the relevant period, Facebook’s Risk Factor disclosures misleadingly 
suggested that the company faced merely the risk of such misuse and any harm to its business 
that might flow from such an incident. This hypothetical phrasing, repeated in each of its 
periodic filings during the relevant period, created the false impression that Facebook had not 
suffered a significant episode of misuse of user data by a developer. 

40. The company’s processes and procedures around the drafting of its periodic 
reports on Forms 10-K and 10-Q, including but not limited to its Risk Factor disclosures, failed 
to bring the researcher’s sale of data from tens of millions of Facebook users to Cambridge to the 
attention of the individuals with primary responsibility for drafting and approving those reports. 
Although protecting user data is critical to Facebook’s business, and Facebook had identified the 
potential for improper access to and misuse of user data as a significant risk, Facebook did not 


2 During the relevant period, Facebook filed three annual reports on Fonn 10-K for the fiscal 
years ended December 31, 2015, December 31, 2016, and December 31, 2017, and six 
quarterly reports on Form 10-Q for each fiscal quarter in 2016 and 2017. 
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maintain disclosure controls and procedures designed to analyze or assess incidents involving 
misuse of user data for potential disclosure in the company’s periodic filings. 

41. During the relevant period, Facebook identified trends and events for possible 
disclosure through a series of quarterly meetings to prepare for the company’s earnings 
announcements. This process relied on the employees and managers who attended these 
meetings to identify issues that might need to be disclosed. Although several employees in 
Facebook’s legal, policy, and communications groups who attended these meetings during the 
relevant period were aware of the researcher’s improper transfer of data to Cambridge, that 
incident was never discussed. Facebook also did not share information regarding the incident 
with its independent auditors and outside disclosure counsel in order to assess the company’s 
disclosure obligations. 

42. Facebook had no specific mechanism to summarize or report violations of its 
Platform Policy to employees responsible for ensuring the accuracy of Facebook’s filings with 
the Commission. For example, the Facebook employees responsible for monitoring violations of 
the company’s Platform Policy were not provided with the draft disclosures pertaining to the 
misuse of user data. 

43. Asa result, Facebook senior management and relevant legal staff did not assess 
the scope, business impact, or legal implications of the researcher’s improper transfer of data to 
Cambridge, including whether or how it should have been disclosed in Facebook’s public filings 
or whether it rendered, or would render, any statements made by the company in its public filings 
misleading. 

44. Based on the foregoing, Facebook filed materially misleading periodic reports 
with the Commission. Facebook knew, or should have known, that its Risk Factor disclosures in 
its annual reports on Fonn 10-K for the fiscal years ended December 31, 2015, December 31, 
2016, and December 31, 2017, and in its quarterly reports on Form 10-Q filed in 2016 and 2017, 
as incorporated into its Fonn S-8 registration statements, were materially misleading. 
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45. The Risk Factor disclosures were incorporated by reference into Facebook’s 
registration statements on Forms S-8 filed with the Commission on May 21, 2012 and 
February 1, 2013. These statements registered sales of shares of Facebook common stock under 
the company’s employee and officer equity incentive plans, and incorporated future periodic 
reports filed with the Commission, including those filed during the relevant period. 

46. During the relevant period, Facebook received approximately $29 million in cash 
proceeds from the exercise of employee stock options. Facebook also granted restricted stock 
units to more than 17,000 new employees during the relevant period who, in some cases, agreed 
to accept lower salaries in exchange for additional equity compensation. 

Facebook’s Statements to the Press Reinforced Its Misleading Filings 

47. Beginning in November 2016, reporters asked Facebook about the investigation 
that the company said it was conducting in the December 2015 Guardian article. These inquiries 
were referred to Facebook’s communications group, which was aware that the company had 
confirmed that the researcher had improperly transferred personality profiles based on U.S. user 
data to Cambridge in violation of Facebook’s policy, and had told both parties to delete the data. 

48. The communications group initially responded to the press inquiries indirectly. 
For example, beginning in February 2017, the communications group pointed reporters to 
Cambridge’s public statement that it “does not use data from Facebook” and “does not obtain 
data from Facebook profiles or Facebook likes.” This was misleading because it suggested that 
Facebook was unaware that Cambridge had improperly obtained Facebook user data. 

49. On at least two subsequent occasions in March 2017, Facebook’s 
communications group provided the following quote to reporters: “Our investigation to date has 
not uncovered anything that suggests wrongdoing.” This was misleading because Facebook had, 
in fact, determined that the researcher’s transfer of user data to Cambridge violated the 
company’s Platfonn Policy. The quote served to reinforce the misleading impression in 
Facebook’s periodic filings that the company was not aware of any material developer misuse of 
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user data. The on-line publication The Intercept included the quote, attributed to a Facebook 
spokesperson, in an article dated March 30, 2017. 

Facebook’s Acknowledgement of the Cambridge Analytica Incident 

50. In March 2018, The New York Times and Guardian contacted Facebook and 
informed the company that the publications planned to run stories about the researcher’s 
improper transfer of data to Cambridge, including that Facebook had told the researcher and 
Cambridge to delete their Facebook data. Reporters from the Times suggested that Cambridge 
had not deleted the data, contrary to its representations to Facebook. 

51. After the close of market on Friday, March 16, 2018, Facebook preempted the 
newspapers’ publication by a post on its own online Facebook “newsroom.” The company 
publicly acknowledged, for the first time, that it had confirmed that the researcher had transferred 
user data to Cambridge, in violation of its Platform Policy, and that the company had told the 
researcher and Cambridge to delete the data in December 2015. When the market opened on 
Monday, March 19, 2018, the price of Facebook’s shares fell five percent, from $185.09 to 
$172.56, and continued to decline throughout the week, closing at $159.39 per share on 

March 23, 2018. 

FIRST CLAIM FOR RELIEF 

Violations of Sections 17(a)(2) and (3) of the Securities Act 

52. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 
through 51, above. 

53. By engaging in the conduct described above, Defendant Facebook, directly or 
indirectly, in the offer or sale of securities, by use of the means or instruments of transportation 
or communication in interstate commerce or by use of the mails, 

(1) obtained money or property by means of untrue statements of material fact or by 
omitting to state a material fact necessary in order to make the statements made, 
in light of the circumstances under which they were made, not misleading; and 
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(2) engaged in transactions, practices, or courses of business which operated or 
would operate as a fraud or deceit upon purchasers. 

54. By reason of the foregoing, Defendant violated, and unless restrained and 
enjoined will continue to violate, Section 17(a) (2) and Section 17(a)(3) of the Securities Act 
[15 U.S.C. §§ 77q(a)(2) and 77q(a)(3)]. 

SECOND CLAIM FOR RELIEF 
Violations of Section 13(a) of the Exchange Act and 
Rules 12b-20, 13a-l and 13a-13 Thereunder 

55. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 
through 51, above. 

56. Defendant has at all relevant times been an issuer that has a class of securities 
registered pursuant to Section 12 of the Exchange Act [15 U.S.C. § 78/]. 

57. As described above, Defendant’s filings with the Commission, including its 
reports filed on Forms 10-K and Forms 10-Q, reflected misleading statements concerning the 
improper access to and misuse of its users’ personal information. 

58. Based on the conduct alleged above, Defendant violated, and unless restrained 
and enjoined will continue to violate, Section 13(a) of the Exchange Act [15 U.S.C. § 78m(a)] 
and Rules 12b-20, 13a-l, and 13a-13 thereunder [17 C.F.R. §§ 240.12b-20, 240.13a-l, and 
240.13a-13], which obligate issuers of securities registered pursuant to Section 12 of the 
Exchange Act [15 U.S.C. § 78/] to file with the Commission periodic reports with information 
that is accurate and not misleading. 

THIRD CLAIM FOR RELIEF 
Violations of Rule 13 a-15(a) of the Exchange Act 

59. The Commission re-alleges and incorporates by reference Paragraph Nos. 1 
through 51, above. 

60. Defendant failed to maintain controls and procedures designed to ensure that 
information required to be disclosed in the reports that it files or submits pursuant to the 
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Exchange Act is recorded, processed, summarized, and reported, within the time periods 
specified in the Commission’s rules and forms. 

61. Defendant also failed to maintain controls and procedures designed to ensure that 
information required to be disclosed in the reports that it files or submits pursuant to the 
Exchange Act is accumulated and communicated to its management, including its principal 
executive and principal financial officers, or persons performing similar functions, as appropriate 
to allow timely decisions regarding required disclosure. 

62. By reason of the foregoing, Defendant violated Rule 13a-15(a) of the Exchange 
Act [17 C.F.R. § 240.13a-15(a)]. 

PRAYER FOR RELIEF 

WHEREFORE, the Commission respectfully requests that this Court: 

I. 

Permanently enjoin Defendant Facebook from directly or indirectly violating 
Sections 17(a)(2) and 17(a)(3) of the Securities Act [15 U.S.C. §§ 77q(a)(2) and 77q(a)(3)], and 
Section 13(a) of the Exchange Act [15 U.S.C. § 78m(a)], and Rules 12b-20, 13a-l, 13a-13, 
and 13a-15(a) [17 C.F.R. §§ 240.12b-20, 240.13a-l, 240.13a-13, and 240.13a-15(a)] thereunder. 

II. 

Issue an order requiring Defendant Facebook to pay a civil monetary penalty pursuant to 
Section 20(d) of the Securities Act [15 U.S.C. § 77t(d)] and Section 21(d) of the Exchange Act 
[15 U.S.C. § 78u(d)(3)]. 

III. 

Retain jurisdiction of this action in accordance with the principles of equity and the 
Federal Rules of Civil Procedure in order to implement and carry out the terms of all orders and 
decrees that may be entered, or to entertain any suitable application or motion for additional 
relief within the jurisdiction of this Court. 
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IV. 

Grant such other and further relief as this Court may determine to be just and necessary. 


Dated: July 19, 2019 


Respectfully submitted, 


/s/Matthew G. Meverhofer _ 

Matthew G. Meyerhofer 
Attorney for Plaintiff 

SECURITIES AND EXCHANGE COMMISSION 
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